Posted
by
CmdrTaco
on Thursday May 29, 2003 @03:32AM
from the p2p-gets-more-and-more dept.

Myriad writes "Nullsoft, makers of the venerable Winamp MP3 player, released today a secure, distributed mesh-like networking protocal and platform called Waste. This v1.0 beta release uses RSA (key based) and Blowfish encryption for security, and features Instant Messanging and group chat, along with file browsing, searching, and transfer. Waste has been released under the GPL, with source and binaries available here."

The other fun part was that, the day after the Gnutella debacle, they managed to sneak in a mention of Nutella (and a picture of it!) into their "Ask Nullsoft" section. I wonder if they'll do something similar with WASTE?

Indeed, here [slashdot.org] is the original slashdot story. Of course AOL quickly ended development at nullsoft, it lived on after the protocol had been reverse engineered and others picked up where nullsoft left off.

I believe the name "Waste" is a references to Thomas Pynchon's novel "The Crying of Lot 49." In the novel, W.A.S.T.E is either a hoax or a secret system for communication, and (might) stand for "We Await Silent Tristero's Empire." Here's a little quote:

"Last night, she might have wondered what undergrounds apart from the couple she knew of communicated by
WASTE system. By sunrise she could legitimately ask what undergrounds didn't....[H]ere were God knew how
many citizens, deliberately choosing not to communicate by U.S. Mail. It was not an act of treason, nor possibly
even of defiance. But it was a calculated withdrawal, from the life of the Republic, from its machinery. Whatever
else was being denied them out of hate, indifference to the power of their vote, loopholes, simple ignorance, this
withdrawal was their own, unpublicized, private. Since they could not have withdrawn into a vacuum (could they?),
there had to exist the separate, silent, unsuspected world."

AOL Time Warner (IIRC, owners of the second biggest recording company, not to mention one of the major recording studios) owns Nullsoft, which releases a program that the RIAA and MPAA will undoubtedly call a tool whose sole purpose is to illicitly distribute copyrighted works....

AOL Time Warner (IIRC, owners of the second biggest recording company, not to mention one of the major recording studios) owns Nullsoft, which releases a program that the RIAA and MPAA will undoubtedly call a tool whose sole purpose is to illicitly distribute copyrighted works....

That was a joke right? And the moderators who marked it "interesting" and "insightful" really meant to mark it "funny", they just hit the wrong button, right?

In fact what we have here is a first cut at a secure distributed network presence system, something that would allow you to run an icq-like network between people you trust without being spied on by a central server. There are many reasons why one would want this: maybe *you* just want to trade copyrighted files, but *I* want to communicate securely and efficiently with my associates.

As for why AOL lets Nullsoft do things like this, I suppose the choice is either to let them work on what they want to or lose the talent. What Nullsoft is doing is the best thing for the net, and so is the best thing for AOL in the end.

In fact what we have here is a first cut at a secure distributed network presence system, something that would allow you to run an icq-like network between people you trust without being spied on by a central server. There are many reasons why one would want this: maybe *you* just want to trade copyrighted files, but *I* want to communicate securely and efficiently with my associates.

Besides which, this software isn't particularly useful for illicit file sharing. For that you need a way to get into contact with strangers who happen to have a copy of the file you want to download. The encryption features would actually seem to work against that.

Also, this is technology that might be very useful to AOL. AIM's big drawback is that it's not very secure, and really shouldn't be used for sensitive corporate communication. (Though the engineers at my last employer used it anyway.) AOL could persuade people that are already using AIM for free to upgrade to WASTE in order to secure their communications. Not to mention the other features.

Yes, it seems to be more of a client where you already have a trusted group of users either from real life (Say, a whole dorm hall or a bunch of co-workers) or from a presence online (Say, a whole gaming guild or software collaborators or even a little message board community) to open some of your system files to. It is a trusted way to get recommended files, be they legal or illegal.

You don't need to be in contact with strangers if all your friends have GBs upon GBs of "shared source".

I run a small network in my apartment with my roommates, and we all have various versions of windows, and some computers are "homed" on a different domain, especially if a friend brings his work laptop over during a lan party.

In these kind of environments, windows file sharing seems to be much more hassle than it's worth. On Win2k, it seems like it's a 10 step process just to share a folder. Even after that, it can take one or two minutes just to

which releases a program that the RIAA and MPAA will undoubtedly call a tool whose sole purpose is to illicitly distribute copyrighted works....

There is no reason to call it that. It is a communication tool that tries not to leak information. I would encourage RIAA members to use it themselves, to better secure internal conversations against unintentional leakage. I'm sure "they" send files to each other via email from time to time. Isn't this better? What's not to like?

As a long time cypherpunk, I'm glad this is here. Way back in '94, I wrote out a model of this sort of thing, but with decent routing and key exchange, and then got busy working for money. I'm glad someone is doing this, even if it doesn't work on a larger scale.

Note: It might be worth implementing WASTE using a subset of SSL, to avoid any concern of flaws in this protocol. Feedback is gladly accepted on any potential weaknesses of the negotiation. We have spent a decent amount of time analyzing this, and although we have found a few things that are not ideal (i.e. if you know public keys from a network, you can sniff some traffic and do an offline dictionary attack on the network name/ID), but overall it seems decent. The current implementation probably needs work, too.

Which suggests to me that it isn't worth rushing out and developing application with *just* yet, until further reviews have occured (and the protocol has matured/evolved).

I read the article and immediately got excited. I downloaded all of the software and had it all setup and working within a few minutes. As of right now I'm living in an apartment and have no practical use, but on Monday I'm moving into my dorm room to start my summer class (bleh!) Anyway, I think this is so wonderful! I've been thinking about a secure network computing solution for my three computers when I'm at school. I have my server, workstation, and my laptop that I'd like to tie all together. The leading choice was vpn, but after playing around with this, I do think that running on my server and having the three of them connect to it, and maybe a few of my friends computers on campus, we can create a very nice, effective, small, and secure lan. Then again, after five minutes I haven't decided if the whole reinventing of the wheel is worth it. I'll probably try it out, and setup a vpn server too, and see which I like more.

Once you've set it up for a firewall, the f/w effectively vanishes inside the VPN. A friend and I struggled with firewall configs for years tweaking for the game of the day. Enter VPN, and now we have a private TCP network without firewalls. Any game supports that, no reconfiguration required.

The other thing is that it is built into w2k (my gaming platform of choice) and XP (friends platform). This means you can be up and running after reading some quick instructions on setting up the server, your shares (properly!), forward one TCP port (yes, only one) from your firewall to desktop, and that's it forever.

Yeah, I had a VPN setup from work to home before, and it didn't always take kindly to the network address translation. Certian things wouldn't function, and I'm hoping that's fixed here. Also, we have a whole chunk of public addresses on campus. I could easily configure the pool to assign some of them, and not worry about the nat, but then there is always a chance that there will be an address conflict. As a former net admin before coming back to school, I can tell you that I don't take too kindly to ro

while you can. Remember what happened when they first released Gnutella? If I recall, AOL forced them to pull it within hours (though it was already completely reverse-engineered almost immediately afterward).

WASTE is a software product and protocol that enables secure distributed communication for small (on the order of 10-50 nodes) trusted groups of users.

So this isn't really a thing like gnutella. It's an enterprise product. As other posters have noted, it could conceivably be used to share (AOL-TW) copyrighted works, but that doesn't seem to be anywhere near it's main purpose. Heck, AOL is probably releasing the core technology as OSS to get the community to shake it down for bugs, in anticipation of releasing a commercial product built on top of the protocol. Kinda like how Apple has worked on open source technologies like zeroconf, and released commercial products like rendezvous built on the technology.

It allows easy colloboration across firewalls, and only one user inside the firewall is required to allow all users inside access to the mesh.

Each link is encrypted, but each message is decrypted and re-encrypted at each hop of the mesh, so you have to trust all of the nodes. It's also very hard to drop a node onc it is trusted, as each node shares public keys around to make sure all nodes have all public keys. Initial connection to the mesh requires manual key exchange. PITA, but moderatley secure.

All network traffic is encrypted, it will flood each mesh link with a minimum amount of bandwidth to foil traffic analysis.

And I doubt that's a coincidence either considering that's exactly what the protocol seems to do.

Now I've never read the book, but I'd say in an underground postal system every person in the system has to be trusted. Much like this protocol -- each node in the network needs to be trusted.

You have to build your own little underground network with a few trusted friends. This reminds me a lot of the pirate BBS days... if you wanted access to the 'private' or 'elite' (we didn't use such silliness as 31337;) file sections, you had to know the sysop.

This system allowed for only quality 'warez' files because everyone who was allowed to trade files had to be trusted, and therefore they weren't going to damage their reputation by sending crap like you get on P2P nowadays like incomplete packages or stuff that said it was one thing, but really was another thing. Back when trading pirated software was more like a gentlemen's agreement and not the 'o-D4Y \/\/4R3Z!!!!' crap pimply-faced teenagers with nothing better to do do today.

On the other hand, one has to think, 'Who needs it?' Most of us who were in that community back then have merged in with the Open Source community today and if we trade software at all it's with a CD burner over a cup of coffee.;) OTOH, maybe this is just the thing for people like us.

In "The Crying of Lot 49" [powells.com], which is a nice short fast spacy read, there's a plot thread about competing mail services and a conspiracy that conducts its private communications in a way that, if you refer to the name of the product as "waste" rather than "W A S T E", indicates you're clearly not part of their group. There are also email systems called "Trystero" for similar reasons, and it makes looking at post office boxes in Scandinavia quite silly even without sampling the local agricultural products.

Resolved that: Gnutella aside, this technology is really a direct shot at Groove Networks, the company founded by Ray Ozzie of Lotus Notes fame to sell P2P-derived technology to small and large business.

Well, that begs the question: what problem is Waste designed to solve? Who will use it?

It seems to me that secure instant messaging and peer-to-peer file transfer between members of a distributed workgroup serves a real need. I can't imagine that Nullsoft would have developed this unless they saw a need themselves. Other solutions might technically already exist, but they don't appear to be as easy to install. (In that respect I could be wrong about VPN; I haven't looked into it.)

I've just gotten off the phone with Bruce Perens, talking about that very topic! At the moment, both Bruce and I are too busy to devote much time to our Debian-focused e-newsletter, Elitist Open Source Zealot Virgin. As you may be aware, I am totally consumed with my current Windows port of apt-get, and Bruce has a full time job just keeping the hobos and crack junkies out of his cardboard box underneath the 23rd Street rail bridge.

Think of it this way, these guys know probably better than anyone else NOT on the AOL IM team, just how much of IM conversations are monitored, logged, mined for information, media metrics...etc.

Not to mention, they work in that environment, they prolly want to be able to say "god damn, our executive VP is a bitch" and not have some network engineer provide a log documenting that conversation later.

Yeah, i wish it scalled, but wtf, its opensource. Go make it scale. For now, 10-50 is plenty for most groups of online friends.

Personally, I'd loved to see technology like Pastry [microsoft.com] get hacked into it.

According to Microsoft [microsoft.com], RemoveDirectory() removes the directory specifed in a C string. The directory must be empty, exactly as with the POSIX rmdir(). The return value is 0 if unsuccessful, non-zero otherwise; this is the opposite of rmdir(). So, it's better to replace that snippet with:

Alright, I think I'm figuring this out. Lack of documentation is something of a hinderance here... It really boils down to there not being any kind of initial configuration system on the server side, so you do all the keygen and profile creation on windows and copy stuff back and forth. Ugly. But, I guess it *is* alpha (though maybe it should be 0.1 rather than 1.0...)

It's compiled (I just made the changes shown elsewhere in this thread). Start up the windows version, create a private/public key pair

...owns Nullsoft, (as already mentioned by leviramsy) but an interesting theory had been presented to me, suggesting that AOL Time Warner has for some time been planning to trump Apple's iTunes store. Maybe they are planning to power such a service with peer networking?
I have never beleived this personally because AOL Time Warner would just as soon want to have everyone surfing from the same servers anyhow, and a decentralized system would only tax their bandwidth more.
Maybe...maybe they will release such a service that utilizes both p2p transfers in combination with traditional server-to-client transfers, and maybe use it as an advertising platform for AOL, giving AOL users better functionality, or maybe even restricting server-to-client transfers to AOL users once the service becomes popular.
Does anyone else think this idea is bogus? I find it hard to beleive, but I can't figure out how else Nullsoft could be/allowed/ to create this new service.

If I remember correctly Justin's contract basically gave him complete freedom from luser management as long as he didn't do anything illegal. Besides he got so much dough from AOL that he could just work on it at home and release it, though it would lack the Nullsoft name that obviously gets it more press. This would be pretty worthless from AOL/TW's perspective, for that they would probably want something like BitTorrent with user authentication.

I'm suprised no one has mentioned the obvious. This is a terrible blow to the RIAA and the all the people who have been trying to sue filesharers into oblivion.

There are two uses I see for this:There are going to be groups of people dedicated to one theme, for example, Horror Movies, or Horror Movies with mutant bees, sharing all their Horror Movies, you will need a certain ammount of Horror Movie Uploads for Downloads and noone will ever be to know you had Queen Bee 1-3.

If you replace Horror with new release you get lots of small miniDonkeys, many interconnected and unstoppable.

I'm convinced this is a revolution in filesharing because it solves the two biggest Problems filesharing has, crappy downloads and getting sued.The downloads will be of really good quality beacause you will be sharing with friends of people you know from chatting and if the put crap in their upload directory they won't be one of your cirle of friends much longer.

Getting sued is obvious, noone will be able to tell what you are doing (the might be able to guess that all those people on cable are not running a vpn yet) as just your circle of friends know. There is still the possibility that one of your friends is a traitor but i would call that a rare chance.

WASTE is something that is indeed very useful for small company or teams (especially dispersed teams) in larger organizations. In many places one or another IM system is being used to communicate with team members. Over ICQ or AOL contracts and employment conditions are discussed, remarks about contractors and clients are passed etc. That is a huge security leak if you look at it from a certain prospective, especially for some profiles of companies like small consulting firms with employees regularly using clients networks. WASTE is a simple to use and free method of closing that leak.

I know at least two small companies that should adopt WASTE immediately and I would advise them to do so. One is a PR company with 2-10 people offices around Europe, where ICQ is frequently used as a discussion medium. Other is a small consulting company. Someone eavesdropping on their ICQ chats could seriously damage both of them.

SecureIM only do encryption. There is NO way with SecureIM to be sure that you are talking to the right person.

It would be very easy for some network admin to do a man in the middle attack by intercepting all the trafic between you and your buddy (with the initial key exchange) without you knowing anything about it.

Having a false sense of security is worse that knowing that your communication is NOT secure.

A better way, would be to use PGP to enrypt your communication with your buddy. At least, if your a

You both need to enter each other's public key into your client to get started. This step shows that you "trust" one another.

Anyone else who wants to join your "network" must also enter one of your existing network members' public key into their client and have that existing member enter the new user's public key into *their* client. This step automatically makes the new person "trusted" by all the other members of the network - the important part is that you don't have to explicitly swap public keys with EVERYONE - just with one member of the network. The client does the rest once you connect to the network - see below.

Now, to get started and initially connect to someone's machine, enter their hostname or IP address (not their "username") into the "Network" window. This primes your client - it will then discover all it needs to know about the other members of the network, since by default, each client will be broadcasting discovery information (usernames, hostnames, public keys).

The "Browser" window shows all the users in the network, but currently ONLY if they are sharing one or more files. So, get each person who joins the network to share at least a test file so that they will always appear in everyone's "Browser" window.

Right-click on any names in the browser window to start interacting with them.

While on the surface, this might seem like a reinvention of IP tunnelling and VPN's, there are a couple of important features bundled in that set it apart:

1. It turns each node into a router. While you can establish a VPN with other tool kits, you still have to enable and configure the routing manually.

2. It's entirely user-land - it's a standalone program that a user can plop on their machine and be on their way.

The best part about it is that you can get through firewalls. The worst part about it is that you can get through firewalls.

Most people are pretty polar in their opinions of firewalls, with most of those people seeing them a fascist mechanism to control what they can see. In some (perhaps most) cases, that can be true. However, firewalls are much more than that: They can (and often are) used to protect YOU, the clueless end-user, from the other bad people on the Internet.

After I clear out counters on firewall rules, it's not uncommon to see 10-20 (sometimes more) incoming attacks within 5 seconds.

So, this will be great for letting people browse the web from work. On the other hand, it will expose them to propagation of worms and attacks which would have otherwise been caught by the firewall.

Is this a good program? Overall, I think that it's a good thing that NullSoft created it. We simply need to realize that with all of the benefits it brings, it will also bring a few negatvies with it.

Well, all the pages about WASTE are 404 now, WASTE also disappeared from the list of software made by Nullsoft. But - as I said already here - it's already irrelevant, as the GPL-ed source is already mirrored around the world and will be worked on. Soon we will see ports and mutations of WASTE everywhere.

You're right. But you have to remember that, by the brief look of it I got, makes PGP-style stuff a lot easier. And what do most people use IM's for anyway? To chat to their friends? You bet. It wouldn't take long to develop a web of trust of, say, your entire school or workplace. But you're also right, it won't gain wide acceptance unless there's easy way to connect to the "network".. I just opened the "Network status" dialog, and what do I type in? Nothing right now, until I can get someone else to load i

I think this is meaningful, as it is an ad-hoc way of creating aa VPN. Also it would probably be faster if a few of the nodes have fast connections. If your friends don't see a reason behind this, then maybe it is not meant for your circle of friends. About the anonymous issue, note that Freenet already exists and works to handle that problem. This is meant to address a completely different issue

What's the point? If you can only connect to people who's key you have, and if only people who have your key can connect to you, this is going to be a pretty private thing.

Exactly, privacy is what it's all about. People tend to forget (or not realize to begin with) that every bit of chatter they send to one another on AIM goes through AOL's servers, every message they send to their buddy on MSN Messenger passes through Microsoft's servers, etc. Waste gives you the ability to conduct reasonably secure conversations and chat. Sure, it's not as geeky as running your own private IRC server wrapped in stunnel, but hey, the easier crypto becomes, the better.

The next time you want to have a chat with a friend, but you don't exactly want the contents bouncing all over the internet in plaintext, this looks like the perfect application. Reminds me somewhat of a program called SIMP [winfosec.com], which is a minimalistic Blowfish-ized IM program.

People tend to forget (or not realize to begin with) that every bit of chatter they send to one another on AIM goes through AOL's servers,

Eh, no it doesn't. Even early versions of ICQ had direct communication between clients. Only if a client is offline does it go through a server. There is no way in hell that the servers could survive otherwise.

Although the messages are in clear text, so someone could sniff them. OTOH the same is true with email.

Eh, yes it does. Otherwise I'd have a lot more connections open while talking to people than just the one single connection to AOL's server. Hence the 'direct connect' button, which then DOES establish a direct connection to the server. Also, ICQ now uses modified versions of the AIM protocol(s) anyway (or at least, can run on them), so all ICQ traffic prolly goes through the servers too.

I bet the other networks are the same. MSN, Yahoo, etc. Direct connections are a bit slower to start up, and a bit more of a security risk, since you now know the other person's IP address.

If your not scared of Beta software, there's an IRC client that supports encryption for queries and even channel messages. You do have to share your key with whom ever you want to be able to read your messages however.

It's KVirc 3 over at www.kvirc.net [kvirc.net].It's primarily writen for KDE/Linux but they also have a pre-compiled Win32 stand-alone.

The problem that we have here is that this network is NOT for piracy and therefore a lot of slashdot readers cannot see the use for it. Think instead of people working together - a workgroup as it where. For example why pay rental fees on an office when you can have a virtual one using tools such as this? Now I am not sure how great this tool is for that right not (I'm guessing - first release - not very) but I am sure it will come if people start using it.

Winamp 2.9 is the latest release of the Winamp 2.x codebase, which takes most of the good ideas that went into Winamp 3 and codes them back to an API free of excessive abstraction. It's been out for weeks, if not months. Check your facts before posting.

" Winamp 2.9 is the latest release of the Winamp 2.x codebase, which takes most of the good ideas that went into Winamp 3 and codes them back to an API free of excessive abstraction. It's been out for weeks, if not months. Check your facts before posting."

How about you read my post again before you tell me what to do. I said "2.81 or whatever the latest 2x version is" . so that's 2.9 I never carved my answer in stone, I made it clear that I was not sure what the latest version was.

Firstly, the WA2 group backported the two major features of WA3 (video support and the media library) to WA2 and released it as WA 2.9. Development continues on a hybrid tree under the working title WA5 (2 + 3 == 5).

Secondly, not everyone shares your idea of "what they need to do". Winamp is a nice media player, but nevertheless just a media player; to many people, a protocol that facilitates cryptographically secure collaboration is infinitely more useful.

Hey good their working on the old series, which would show they accept the issues of the 3x series.

I know many people do feel the way I do, talk to most people who have tried 3.0 or even go to their website and see people bitching about it. Winamp is the most used player in windows, second only to WMP, though I wouldn't be surprised if more used. To stop trying to make a decent product and ignore the problems will cause them to loose their marketshare and thus make them worthless, not a very good business model if you want to be around to do other things like protocols.

Also I don't think many people care about this protocol, sure the paranoid types might, but this is very much something most people could care less about.

Also I in no way have said they are obligated to do anything. I was just pointing out how they have gone from something good to complete crap. I don't belive companies own anyone anything unless there was some deal which requires them to.

I doubt it was done in spare time, if it was employees doing something it was during work time, and if there are things that need to be done to your product you don't have "free time" . Free time is when there is nothing you should be doing.

Nullsoft is a company. Time is money for them. Users are money for them. Being a company that gives product away for free, the balance of keaping them is huge. If no one goes to your sight and clicks on ads and so forth they are done.

One last thing, they haven't fixed jake shit. winamp 3 is broken, go to their sight, winamp 3 is what they are advertising. Making updates to an older product is not fixing. To be fixed means they got all the issues sorta out with 3.0 .

To a certain extent this protocol is probably far more important than winamp will ever be.
We keep hearing predictions of how IM is the next big thing in business, however no buiness is going to touch current IM technologies for two main reasons, security and accessibility (if I have MSN installed I will spend more time chatting to my mates than collaborating with my colleagues).
WASTE solves those two problems and therefore enables businesses to seriously look at using IM type technologies in the work pl

WASTE is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

WASTE is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

WASTE is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with WASTE; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA*/

Thread
ID#13077 [winamp.com] in a message entitled WASTE gone... RETURNED! (look in the forum CommunityCenter/GeneralDiscussions at
forums.winamp.com
[winamp.com]
has the source and binary posted.

You'll have to register for the WinAmp forums first.

Not sure if the poster hacked/altered them first, but at least something appears to be there. I was unable to grab the installer earlier, but I did grab the.zip for the sources earlier. The.zip I grabbed earlier and the.zip posted in said forum match according to the cmp command.

I'm gonna build from the sources myself rather than run the posted.EXE.